The Betheme WordPress theme contains a critical vulnerability that allows authenticated contributors to achieve remote code execution on the host server.

The vulnerability is an improper control of code generation, allowing an attacker with contributor-level access to inject and execute arbitrary code. This bypasses typical theme restrictions and grants the attacker significant control over the WordPress instance.

An attacker with contributor access can escalate their privileges to full system control, leading to complete site compromise, data exfiltration, or the deployment of persistent malware. Given the CVSS score of 9.9, this vulnerability poses an extreme threat to the integrity and availability of the entire web server environment.

Immediate Action: Update the Betheme theme to the latest available version that addresses this vulnerability. If an update is not yet available, restrict contributor access or disable the theme until a patch is applied.

Proactive Monitoring: Review WordPress user logs for suspicious activity by contributors and monitor server file integrity for unauthorized modifications.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block malicious code injection attempts targeting WordPress themes.

Public Exploit Available: Unknown.

Security teams should audit their WordPress installations to identify the use of Betheme and enforce immediate updates. Restricting administrative and contributor access remains a vital defense-in-depth measure until the vendor provides a verified patch.